CHFI Storage Forensics and File System Analysis Practice Question

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

⚠ Common exam trap

Watch out — candidates often confuse file slack with volume slack or free space, not realizing that file slack is specifically the unused portion within a file's allocated cluster(s) that can still hold residual data from prior file writes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

File slack

File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Volume slack
Why it's wrong here
Volume slack refers to the unallocated space on a storage volume that lies beyond the filesystem's end-of-volume marker, typically caused by partition alignment or when the volume size is not an exact multiple of the cluster size. It is not related to an individual file's allocated cluster chain, so it cannot account for the unused space at the end of the file's last cluster. Since the file's allocated clusters are all within the volume's data area, volume slack is not the correct classification for this scenario.
✗
Free space
Why it's wrong here
Free space consists of clusters on the NTFS volume that are marked as unallocated in the Master File Table (MFT) bitmap and are available for new file writes. The unused portion inside the final cluster of the file is still part of that cluster, which has been allocated to the file; therefore, it is not free space because the cluster cannot be reallocated until the file is deleted or truncated. This distinction is critical because the data remnant resides within an allocated cluster, not in an unallocated one.
✗
RAM slack
Why it's wrong here
RAM slack is the byte range from the end of the logical file data to the end of the last sector being read, which exists only in memory during an I/O operation and is a subset of file slack. In NTFS, a cluster comprises multiple sectors, and file slack between the file's logical end and the cluster boundary includes both RAM slack (to the sector boundary) and the remaining sectors to the cluster end. The scenario specifically describes slack at the cluster level, so RAM slack alone is too narrow an explanation and does not account for the full unused cluster space.
✓
File slack
Why this is correct
File slack is the unused area within the last allocated cluster of a file, spanning from the bytes beyond the logical end of the file to the physical end of that cluster, and it is composed of both RAM slack and the remaining sector space. On NTFS, these bytes are not zeroed when a file is written, so they may contain residual data from previously deleted files or older versions of the current file, making them a valuable forensic source. This exactly matches the analyst's observation of a file occupying 40 clusters where some space is unused, because that space remains attributed to the file's allocated cluster rather than to free or volume slack.

Go deeper

CHFI Storage Forensics and File System Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question